CVE-2026-32188 - Vulnerability Details - OpenCVE

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	365 Apps Excel 2016 Office 2019 Office 2021 Office 2024 Office Macos 2021 Office Macos 2024

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188

History

Tue, 14 Apr 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Title		Microsoft Excel Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft 365 Apps Microsoft excel 2016 Microsoft office 2019 Microsoft office 2021 Microsoft office 2024 Microsoft office Macos 2021 Microsoft office Macos 2024
Weaknesses		CWE-125
CPEs		cpe:2.3:a:microsoft:365_apps:::::enterprise:::* cpe:2.3:a:microsoft:excel_2016:::::::x86:* cpe:2.3:a:microsoft:office_2019:::::::: cpe:2.3:a:microsoft:office_2021:::::long_term_servicing_channel:::* cpe:2.3:a:microsoft:office_2021:::::ltsc:::* cpe:2.3:a:microsoft:office_2024:::::long_term_servicing_channel:::* cpe:2.3:a:microsoft:office_macos_2021::::::long_term_servicing_channel::* cpe:2.3:a:microsoft:office_macos_2024::::::long_term_servicing_channel::*
Vendors & Products		Microsoft Microsoft 365 Apps Microsoft excel 2016 Microsoft office 2019 Microsoft office 2021 Microsoft office 2024 Microsoft office Macos 2021 Microsoft office Macos 2024
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-04-14T16:57:33.959Z

Updated: 2026-04-14T19:27:38.455Z

Reserved: 2026-03-11T00:26:53.426Z

Link: CVE-2026-32188

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-04-14T18:17:23.410

Modified: 2026-04-14T18:17:23.410

Link: CVE-2026-32188

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32188", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-03-11T00:26:53.426Z", "datePublished": "2026-04-14T16:57:33.959Z", "dateUpdated": "2026-04-14T19:27:38.455Z"}, "containers": {"cna": {"title": "Microsoft Excel Information Disclosure Vulnerability", "datePublic": "2026-04-14T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:ltsc:*:*:*", "versionStartIncluding": "16.0.0.0", "versionEndExcluding": "16.0.10417.20113"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "16.108.26041219"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "16.108.26041219"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:excel_2016:*:*:*:*:*:*:x86:*", "versionStartIncluding": "16.0.0.0", "versionEndExcluding": "16.0.5548.1000"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Excel 2016", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.0.0", "lessThan": "16.0.5548.1000", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office 2019", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "19.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2021", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2024", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2021", "versions": [{"version": "16.0.1", "lessThan": "16.108.26041219", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2024", "versions": [{"version": "16.0.0", "lessThan": "16.108.26041219", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Office Online Server", "versions": [{"version": "16.0.0.0", "lessThan": "16.0.10417.20113", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-125: Out-of-bounds Read", "lang": "en-US", "type": "CWE", "cweId": "CWE-125"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-04-14T16:57:33.959Z"}, "references": [{"name": "Microsoft Excel Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32188", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T18:50:56.401892Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T19:27:38.455Z"}}]}}